# Grok: identify start of multiline message inside a line
**URL:** https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210
**Category:** Logstash
**Created:** [February 23, 2017, 12:06pm UTC](https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210 "2017-02-23T12:06:41Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@crebegea](https://discuss.elastic.co/u/crebegea)
#### Post date: [February 23, 2017, 12:06pm UTC](https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210/1 "2017-02-23T12:06:41Z")
Hi,
I am having serious problems parsing some logs of ours. The Problem is that the messages, which are also multiline, begin in the middle of the line. There is a workable pattern for the beginning of the message but how can I instruct logstash to correctly cut the message?
the log looks something like this:
{code}
beginmessage:restofthemessage:otherinfo
#0stack
#1stackbeginmessage:rest....
{code}
trying something like
{code}
multiline {
pattern =\> "begin\*"
negate =\> true
what =\> previous
}
{code}
doesn't work.
Is it even possible to parse this?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 23, 2017, 12:08pm UTC](https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210/2 "2017-02-23T12:08:05Z")
If you change the pattern to `^beginmessage:` I don't see why it shouldn't work.
---
### Author:  [@crebegea](https://discuss.elastic.co/u/crebegea)
#### Post date: [February 23, 2017, 12:10pm UTC](https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210/3 "2017-02-23T12:10:30Z")
Thanks for the reply. It doesn't work though, as the begin pattern is not placed at the beginning of the line.
---
### Author:  [@crebegea](https://discuss.elastic.co/u/crebegea)
#### Post date: [February 23, 2017, 12:44pm UTC](https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210/4 "2017-02-23T12:44:34Z")
I kinda got something. With:
%{GREEDYDATA:lasthalf}begin:%{GREEDYDATA:firsthalf}
I could get the right parts of the message. Problem is now that they are intermingled. How can I form an entry using the lasthalf from the last message and the firsthalf from the current one?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2017, 12:44pm UTC](https://discuss.elastic.co/t/grok-identify-start-of-multiline-message-inside-a-line/76210/5 "2017-03-23T12:44:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.